Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/07/2026, 12:16
General
- Target TWD_Definitive_Series_TRyama_v5.exe
- Size 6.8MB
- Sample260710-pfx1vscy2y
- SHA256 7ed1de8f5f27829a79ed1ec66791c6f683057516ac4f031e615edc781ed5fd4f
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 8 IoCs
- Program crash 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Suspicious behavior: EnumeratesProcesses 26 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TWD_Definitive_Series_TRyama_v5.exe"C:\Users\Admin\AppData\Local\Temp\TWD_Definitive_Series_TRyama_v5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TNC18.tmp\TWD_Definitive_Series_TRyama_v5.tmp"C:\Users\Admin\AppData\Local\Temp\is-TNC18.tmp\TWD_Definitive_Series_TRyama_v5.tmp" /SL5="$400AE,6511399,330240,C:\Users\Admin\AppData\Local\Temp\TWD_Definitive_Series_TRyama_v5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 9523⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 9723⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 5144 -ip 51441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 5144 -ip 51441⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
BASS.dll
ISDone.dll
VclStylesInno.dll
bp.dll
gifctrl.dll
TWD_Definitive_Series_TRyama_v5.tmp
memory/3188-2-0x000000000041E000-0x000000000041F000-memory.dmp
memory/3188-0-0x0000000000400000-0x000000000045B000-memory.dmp
memory/3188-110-0x0000000000400000-0x000000000045B000-memory.dmp
memory/5144-72-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-8-0x0000000000400000-0x00000000005A7000-memory.dmp
memory/5144-32-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-42-0x0000000004000000-0x0000000004001000-memory.dmp
memory/5144-47-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-48-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-49-0x0000000004020000-0x0000000004021000-memory.dmp
memory/5144-44-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-43-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-41-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-46-0x0000000004010000-0x0000000004011000-memory.dmp
memory/5144-40-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-45-0x0000000000400000-0x00000000005A7000-memory.dmp
memory/5144-38-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-37-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-39-0x0000000003FF0000-0x0000000003FF1000-memory.dmp
memory/5144-35-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-36-0x0000000003FE0000-0x0000000003FE1000-memory.dmp
memory/5144-31-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-28-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-34-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-29-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-27-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/5144-33-0x0000000003FD0000-0x0000000003FD1000-memory.dmp
memory/5144-50-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-70-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/5144-67-0x0000000004CF0000-0x0000000004CF1000-memory.dmp
memory/5144-24-0x00000000049C0000-0x0000000004BE5000-memory.dmp
memory/5144-78-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-84-0x0000000004D30000-0x0000000004DA6000-memory.dmp
memory/5144-91-0x0000000074E80000-0x0000000074ED0000-memory.dmp
memory/5144-99-0x0000000004DB0000-0x0000000004DD9000-memory.dmp
memory/5144-69-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-30-0x0000000003FC0000-0x0000000003FC1000-memory.dmp
memory/5144-95-0x0000000000400000-0x00000000005A7000-memory.dmp
memory/5144-77-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-71-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-75-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-74-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-80-0x0000000000400000-0x00000000005A7000-memory.dmp
memory/5144-68-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-66-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-65-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-63-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-60-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-59-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-56-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-57-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-76-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/5144-73-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/5144-64-0x0000000004070000-0x0000000004071000-memory.dmp
memory/5144-62-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-61-0x0000000004060000-0x0000000004061000-memory.dmp
memory/5144-58-0x0000000004050000-0x0000000004051000-memory.dmp
memory/5144-55-0x0000000004040000-0x0000000004041000-memory.dmp
memory/5144-53-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-51-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-54-0x0000000003E80000-0x0000000003FC0000-memory.dmp
memory/5144-52-0x0000000004030000-0x0000000004031000-memory.dmp
memory/5144-104-0x0000000000400000-0x00000000005A7000-memory.dmp
memory/5144-105-0x0000000000400000-0x00000000005A7000-memory.dmp
memory/5144-109-0x0000000004DB0000-0x0000000004DD9000-memory.dmp
memory/5144-107-0x00000000049C0000-0x0000000004BE5000-memory.dmp
memory/5144-108-0x0000000004D30000-0x0000000004DA6000-memory.dmp
memory/5144-9-0x0000000000400000-0x00000000005A7000-memory.dmp